Hacker News Reader

Hacker News

Comment by 908B64B197 | Hacker News Reader

Parent Full thread

908B64B197

> There is nothing particularly technically exotic about them

Nor is their mitigation.

I honestly wouldn't brag online about my software being vulnerable to… 9 years old script kiddies!

View on HN

You know how everyone complains about much of the web being behind CloudFlare and their captchas?

The fact that it is not easy or cheap to mitigate DDOS on your own, while it's become surprisingly cheap and easy to launch such attacks, is much of the reason for that.

Most of the Web that's not megacorp owned or behind CloudFlare (or similar) only isn't constantly falling over because it's not being targeted, not because defending against DDOS is super-easy and cheap and so they're all well-protected.

The software has nothing to do with it, the "vulnerability" is that they probably have a 1Gbps port that is getting 5Gbps of reflected UDP thrown at it. I'd love to see your software mitigation for that.

Have a connection broker on another IP address that you authenticate against prior to getting connection details for the real system. Rotate the IP addresses the real system uses every couple of days. Let brokered connections live for 48 hours so the DDOS attack has to last that long to do anything. If the real system gets attacked, drop that IP and pick up a new one, noting what users received that IP address as they are potentially the attacker.

Not perfect but it would probably stop these kids.

Unless the connection broker has more bandwidth than the server, the attack will just take it out instead, still denying access to the site. Either it doesn't work or it's just adding more bandwidth with extra steps. Your solution might help people already connected to the server, but anyone else is still out of luck.

It will help anyone who connected to the server within 48 hours, it will also eventually reveal who is responsible for the attacks to some degree. This won't work if anyone on the internet can make a account, but this situation is a finte group of people that you can eliminate.

Yes but those extra steps are material in handling the DDOS because of differences in time, effort, and expertise required to get them setup. The work required to handle a UDP flood when your application is TCP only is different than a highly motivated attacker with the resources to do a TCP-based attack that looks like legitimate traffic.

Remember, we're talking about a very motivated 9 years old here.

Reply on news.ycombinator.com